Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
https://cwe.mitre.org/data/definitions/330.html →Open in CWE collection →This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
https://capec.mitre.org/data/definitions/59.html →Open in CAPEC collection →In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
https://capec.mitre.org/data/definitions/112.html →Open in CAPEC collection →An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
https://capec.mitre.org/data/definitions/485.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| putty | Tracked | |
| debian_linux | * | Tracked |